Phishing was the initial access vector in 50% of attacks during the first quarter of 2025, according to a new report from Cisco Talos.
“Threat actors used phishing to achieve initial access in 50 percent of engagements, a notable increase from less than 10 percent last quarter,” Talos writes.
“Vishing was the most common type of phishing attack seen, accounting for over 60 percent of all phishing engagements, though we also observed malicious attachments, malicious links, and business email compromise (BEC) attacks.
Adversaries predominately leveraged phishing to gain access to a valid account, pivot deeper into the targeted network, and expand their foothold, contrasting other phishing objectives we have seen in the past such as eliciting sensitive information or monetary transfers.”
Additionally, ransomware surged by 20%, accounting for half of Talos’s engagements in Q1 2025. A single campaign using the BlackBasta and Cactus ransomware made up 60% of these ransomware incidents, targeting manufacturing and construction organizations. These attacks began with voice phishing (vishing) attempts that tricked employees into granting access.
“The attack chain we observed begins with the threat actors flooding users’ mailboxes at targeted organizations with a large volume of benign spam emails,” Talos explains. “After a few days, the actors call the victim, usually via Microsoft Teams, and direct them to initiate a Microsoft Quick Assist remote access session, helping them with the installation of the program if not already present on the user’s system.”
Once the attacker gains access, they establish persistence, escalate privileges, and move laterally before deploying the ransomware.
Talos recommends user awareness training as a layer of defense against these types of social engineering attacks.
“Half of the engagements this quarter involved social engineering, potentially highlighting insufficient user education,” the researchers write. “This security weakness corresponds with the surge in phishing attacks, as users were manipulated to grant attackers access to their environments, with vishing proving to be particularly effective.
Talos IR recommends raising awareness of phishing and social engineering techniques, as user education is a key part of spotting phishing attempts, countering MFA bypass techniques, and knowing where to report suspicious activity.”
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
Cisco Talos has the story.
